Retail by Gingr

1. Information We Collect

We collect information to provide a seamless, secure, and compliance-ready POS experience. The categories of information we collect include:

A. Merchant & Business Account Data

• Business Details: Store name, registered business address, GSTIN (GST identification number), and state jurisdiction.
• Account Credentials: Mobile number, email address, password, and profile settings.
• Staff Records: Names, contact details, attendance, clock-in/out logs, and system roles.

B. Transaction & Billing Data

• Sales Details: Products purchased, quantities, unit prices, discounts applied, taxes (CGST, SGST, IGST), and billing timestamps.
• Customer Information: Contact phone numbers, names, addresses (for intra-state/inter-state tax rules), and outstanding credit balances.
• Payment Records: Selected payment methods (Cash, UPI, Card, Wallet) and status.

C. Inventory & Product Data

• Product catalogs, descriptions, SKU/HSN codes, stock quantities, cost prices, and selling prices.

2. How We Use Your Information

We process personal data in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 (India). We use the collected data for the following purposes:

3. Data Hosting and Storage

Data in transit is encrypted using Secure Socket Layer / Transport Layer Security (SSL/TLS), and data at rest is stored in secure database environments with access control checks.

4. Data Retention

We retain personal and transaction data for as long as your account remains active and as necessary to provide the Service. Following account closure, we retain transaction and invoice records for the period mandated by applicable Indian tax and accounting laws (including GST audit requirements), after which such data is securely deleted or anonymised, unless a longer retention period is required by law.

5. Compliance with the Indian DPDP Act, 2023

As a Data Fiduciary under the DPDP Act 2023, we adhere to the following principles:

• Consent-Based Processing: Consent is obtained before processing personal data of merchants, staff, and customers.
• Right to Access & Correction: You can update, correct, or request a summary of the personal data stored in your account.
• Right to Erasure (Right to be Forgotten): You may request the deletion of your account and associated personal data, subject to statutory tax retention laws (e.g., maintaining transaction invoices for GST audits).
• Data Minimization: We only collect the minimum required data to process invoices and comply with tax rules.
• Breach Notification: In the event of a personal data breach likely to affect you, we will notify you and the relevant authority as required under the DPDP Act.

6. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal data. We only share information in the following circumstances:

• With Your Staff: Authorized employees can view invoice records, customer names, and inventory levels based on their role permissions.
• Service Providers: With trusted third parties (such as our cloud hosting and SMS/email delivery providers) who process data solely on our behalf and under contractual confidentiality obligations.
• Legal Requirements: If required to do so by Indian tax authorities, law enforcement agencies, or under any statutory obligation (e.g., GST audit requirements).

7. Cross-Border Data Transfer

Your data is hosted and stored within India, on servers located in the AWS Mumbai (ap-south-1) region. We do not routinely transfer personal data outside India. In the limited event a transfer becomes necessary (for example, to a service provider located outside India), we will do so only in accordance with the requirements of the DPDP Act, 2023 and applicable government notifications.

8. Data Security

We implement rigorous technical and organizational security measures to protect data from unauthorized access, modification, or leakage. However, please remember that no method of transmission over the internet or method of electronic storage is 100% secure.

9. Children's Privacy

Retail by Gingr is intended for use by businesses and individuals who are at least 18 years of age. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it.

10. Grievance Redressal

In accordance with the Information Technology Act, 2000 and rules made thereunder, we have designated a Grievance Officer to address any concerns regarding this Privacy Policy or the handling of your personal data.

• Grievance Officer: Gingr Informatics Private Limited
• Email: contact@gingr.in
• We aim to acknowledge grievances within a reasonable time and resolve them as expeditiously as possible, and in any event within the timelines prescribed under applicable Indian law.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified to you via the Application or by email at least 15 days before taking effect, where practicable. Continued use of the Service after changes take effect constitutes your acceptance of the revised Policy.

12. Contact Us

If you have any questions about this Privacy Policy, your rights under the DPDP Act, or to request data deletion/correction, please contact us at: